Intelligent responding to error screen associated errors

ABSTRACT

Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: obtaining iteratively captured frames of image data representing a user interface screen, wherein one or more of the frames of image data represents an error screen indicating an error condition of one or more resource of a plurality of resources of a services system; performing recognition processing using image data of the captured frames of image data to determine an error classifier associated to the error screen: determining one or more action based on the error classifier; and performing the one or more action in response to the determining.

BACKGROUND

The present disclosure relates to artificial intelligence (AI) andcomputer machine learning and particularly to a computer implementedsystem for management of actions in response to errors associated toerror screens.

Data structures have been employed for improving operation of computersystem. A data structure refers to an organization of data in a computerenvironment for improved computer system operation. Data structure typesinclude containers, lists, stacks, queues, tables and graphs. Datastructures have been employed for improved computer system operatione.g. in terms of algorithm efficiency, memory usage efficiency,maintainability, and reliability.

Artificial intelligence (AI) refers to intelligence exhibited bymachines. Artificial intelligence (AI) research includes search andmathematical optimization, neural networks and probability. Artificialintelligence (AI) solutions involve features derived from research in avariety of different science and technology disciplines ranging fromcomputer science, mathematics, psychology, linguistics, statistics, andneuroscience. Machine learning has been described as the field of studythat gives computers the ability to learn without being explicitlyprogrammed (Samuel).

SUMMARY

Shortcomings of the prior art are overcome, and additional advantagesare provided, through the provision, in one aspect, of a method. Themethod can include, for example: obtaining iteratively captured framesof image data representing a user interface screen, wherein one or moreof the frames of image data represents an error screen indicating anerror condition of one or more resource of a plurality of resources of aservices system; performing recognition processing using image data ofthe captured frames of image data to determine an error classifierassociated to the error screen indicating an error condition of one ormore resource of a plurality of resources of a services system, whereinthe performing recognition processing includes using historical data ofa data repository, the historical data including data of past errors ofthe services system; determining one or more action based on the errorclassifier, wherein the determining includes using a decision datastructure that cognitively maps, for first through Nth errorclassifiers, an error classifier to at least one action associated tothe error classifier; and performing the one or more action in responseto the determining, wherein the one or more action is an action forcorrection of the error condition indicated by the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system.

In another aspect, a computer program product can be provided. Thecomputer program product can include a computer readable storage mediumreadable by one or more processing circuit and storing instructions forexecution by one or more processor for performing a method. The methodcan include, for example: obtaining iteratively captured frames of imagedata representing a user interface screen, wherein one or more of theframes of image data represents an error screen indicating an errorcondition of one or more resource of a plurality of resources of aservices system; performing recognition processing using image data ofthe captured frames of image data to determine an error classifierassociated to the error screen indicating an error condition of one ormore resource of a plurality of resources of a services system, whereinthe performing recognition processing includes using historical data ofa data repository, the historical data including data of past errors ofthe services system; determining one or more action based on the errorclassifier, wherein the determining includes using a decision datastructure that cognitively maps, for first through Nth errorclassifiers, an error classifier to at least one action associated tothe error classifier; and performing the one or more action in responseto the determining, wherein the one or more action is an action forcorrection of the error condition indicated by the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system.

In a further aspect, a system can be provided. The system can include,for example a memory. In addition, the system can include one or moreprocessor in communication with the memory. Further, the system caninclude program instructions executable by the one or more processor viathe memory to perform a method. The method can include, for example:obtaining iteratively captured frames of image data representing a userinterface screen, wherein one or more of the frames of image datarepresents an error screen indicating an error condition of one or moreresource of a plurality of resources of a services system; performingrecognition processing using image data of the captured frames of imagedata to determine an error classifier associated to the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system, wherein the performing recognitionprocessing includes using historical data of a data repository, thehistorical data including data of past errors of the services system;determining one or more action based on the error classifier, whereinthe determining includes using a decision data structure thatcognitively maps, for first through Nth error classifiers, an errorclassifier to at least one action associated to the error classifier;and performing the one or more action in response to the determining,wherein the one or more action is an action for correction of the errorcondition indicated by the error screen indicating an error condition ofone or more resource of a plurality of resources of a services system.

Additional features are realized through the techniques set forthherein. Other embodiments and aspects, including but not limited tomethods, computer program product and system, are described in detailherein and are considered a part of the claimed invention.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more aspects of the present invention are particularly pointedout and distinctly claimed as examples in the claims at the conclusionof the specification. The foregoing and other objects, features, andadvantages of the invention are apparent from the following detaileddescription taken in conjunction with the accompanying drawings inwhich:

FIG. 1 is a system block diagram having a manager system and a servicesystem according to one embodiment;

FIG. 2 is a flowchart illustrating a method that can be performed by amanager system according to one embodiment;

FIG. 3 is a flowchart illustrating a method that can be performed by amanager system according to one embodiment;

FIG. 4 is a flowchart illustrating a method that can be performed by amanager system interoperating with a services system, an administratorclient computer device, a camera, and a support services administratorclient computer device according to one embodiment;

FIGS. 5A-5E depict an administrator user interface having variations oferror screen areas according to one embodiment;

FIG. 6 depicts a support administrator user interface according to oneembodiment;

FIG. 7 is a block diagram illustrating performance of a machine learningprocess according to one embodiment;

FIG. 8 depicts a computing node according to one embodiment;

FIG. 9 depicts a cloud computing environment according to oneembodiment; and

FIG. 10 depicts abstraction model layers according to one embodiment.

DETAILED DESCRIPTION

System 100 for use in managing action in response to an error screen isillustrated in FIG. 1. System 100 can include manager system 110 havingan associated data repository 112, services system 160, and servicesupport administrator client computer device 170. The system can furtherinclude administrator client computer device 120 and camera 130. Managersystem 110, services system 160, administrator client computer device120, and camera 130 are in communication with one another via network180.

System 100 can include numerous devices, which may be computernode-based devices connected via network 180. Network 180 can be aphysical network and/or a virtual network. The physical network can be,for example, a physical telecommunications network connecting numerouscomputer nodes or systems, such as computer servers and computerclients. The virtual network can, for example, combine numerous physicalnetwork or parts thereof into a logical virtual network. In anotherexample, numerous virtual networks can be defined over a single physicalnetwork.

In one embodiment, manager system 110 can be external to services system160. In another embodiment, manager system 110, services system 160,service support administrator client computer device 170, administratorclient computer device 120, and camera 130 can be external to oneanother. In yet another embodiment, one or more of manager system 110,services system 160, service support administrator client computerdevice 170, administrator client computer device 120, and camera 130 canbe co-located with one another.

In one embodiment system 100 can include second to Zth manager systems110B-110Z. In one embodiment, system 100 can include second to Zthservices systems 160B-160Z. In one embodiment services system 160 caninclude resources 2602A through 2602Z, and one or more IT managementsystem 2604. Resources of resources 2602A-2602Z can include e.g.applications and/or computing nodes running such applications.Applications running on computing nodes can configure such computingnodes as servers, such as, e.g., web servers, mail servers, databaseservers, real-time communication servers, artificial intelligence (AI)servers, FTP servers, and/or collaboration servers. One or more ITmanagement system 2604 of services system 160 can run on resources ofresources 2602A-2602Z. One or more IT management systems 2604 caninclude, in one embodiment, IT management systems of different types.

IT management system 2604, in one embodiment, can be provided by anapplication performance management (APM) system. An APM system canmonitor and manage performance and availability of softwareapplications. An APM can detect and diagnose complex applicationperformance problems to maintain an expected level of service. Oneexample of an application performance metric that can be tracked usingan APM IT management system is an application response time under peakload. APM can also measure resources used by an application for a load,e.g., indicating whether there is adequate capacity to support the load,as well as possible locations of performance bottlenecks. Response timesfor components of applications can be monitored to help identify causesof a delay. An APM can provide user experience monitoring, e.g., userexperience monitoring, application runtime monitoring, and user-definedtransaction profiling.

In one embodiment, IT management system 2604 can include an ITmanagement system that monitors system-level functionalities, such asCPU usage and frequency, the amount of free RAM space, the amount ofspace on one or more hard drives, CPU temperature, IP addressutilization (such as current rates of uploads and downloads), systemuptime and downtime, hard drive parameter data, and voltages beingprovided by a power supply. One commercially available for use inproviding an IT management system is IBM® Tivoli IT Management System,available from International Business Machines Corporation, of Armonk,N.Y., USA (IBM® and Tivoli® are registered trademarks of InternationalBusiness Machines Corporation).

In one embodiment, IT management system 2604 can include an eventmonitoring IT management system. Events that can be monitored caninclude, for example, overloading events, out-of-memory events, VMmigration events. An example of a commercially available event ITmanagement system for managing events is IBM® OMNIbus®, available fromInternational Business Machines Corporation (IBM® and OMNIbus® areregistered trademarks of International Business Machines Corporation).

In one embodiment, IT management system 2604 can include an eventlogging IT management system. An event logging IT management system canperform logging of events from e.g. applications, network devices,operating systems, and containers. An example of a commerciallyavailable event logging IT management system is the open source GRAYLOG™event logging IT management system available from Graylog, Inc. (GRAYLOGis a trademark of Graylog, Inc.).

In one embodiment, services system 160 administrator client computerdevice 120 and camera 130 can be utilized by a common enterprise. In oneembodiment, services system 160 can be provided by software servicesprovider, and made available for use by an enterprise by subscription.An enterprise can subscribe to various services available withinservices system 160 and have access to a subset of resources withinservices system 160, namely the depicted resources 2602A-2602Z, whichare available for use by an enterprise. Example services can includee.g. hosting services, data storage service, image recognition services,artificial intelligence services. In such an embodiment, anadministrator associated to administrator client computer device 120 canbe an administrator of the enterprise subscribing to a subset ofservices of the services system.

System 100 can generate error screens that appear on the display ofadministrator client computer device 120, depicting a range of problemsinvolving functionalities of first through Zth resources of theresources 2602 a-2602 z that are accessible and subscribed to by theenterprise. Error screens displayed on a display of administrator clientcomputer device 120 can depict errors in one or more resource orresources 2602 a-2602 z. Error screens can be generated by resources ofresources 2602A-2602Z including by applications running on one or morecomputing node. Error screen types can include for example: (a) a webbrowser error screen, including an error screen that directs to a 404page; (b) an error dialog error screen that specifies a dialog oferrors; (c) a screen glitch error screen, (d) a component positioningerror screen wherein a screen component is rendered at an incorrectlocation; (e) functional error screen characterized by improperfunctioning of an application (a search engine search for “apples”returns “oranges”).

Manager system 110 can be configured to process image datarepresentations of such error screens displayed on a display ofadministrator client computer device 120. Manager system 110 can provideone or more output in response to a processing of an error screen.

Manager system 110 can run various processes, including preparation andmaintenance process, natural language processing, an NLP process 113,recognition process 114, artificial intelligence (AI) action selectionprocess 115, and machine learning process 116.

Data repository 112 can store various data. In error history area 2121data repository 112 can store data on previously registered errorscreens. Error history area 2121 can store data representing pastregistered error screens as well as data on administrator activityevents associated to the error screens. Administrator activity eventsdata can define context data associated to error screens. Such contextdata can facilitate recognition of errors associated to error screens.In area 2122, data repository 112 can store one or more decision datastructure. A stored decision data structure can include, e.g. aknowledgebase that maps identifiers for error classifications todecisions associated to such identifiers. The action decisions can beiteratively updated by machine learning in one embodiment. In correctiveaction history area 2123, data repository 112 can store recordsspecifying actions taken with respect to prior error screen errorshaving associated error screens. Patch repository 2124 of datarepository 112 can store a library of software patches that areavailable for use in improving the performance of one or more resourceof resources 2602A-2602Z. A software patch, as set forth herein, caninclude a piece of software designed to update the software programand/or supporting data to fix or improve the performance of a programand/or data of one or more resource of resources 2602 a-2602 z. Asnoted, with the use of manager system 110, one or more output can beprovided in response to a recognition process.

Manager system 110 can run preparation and maintenance process 111 toautomatically update data records of areas 2121, 2122, 2123, and 2124 ofdata repository 112. Collected data of areas 2121, 2122, 2123, and 2124can support processes run by manager system 110.

Manager system 110 can run NLP process 113 to process data forpreparation of records that are stored in data repository 112 and forother purposes. Manager system 110 can run a Natural Language Processing(NLP) process 113 for determining one or more NLP output parameter of amessage. NLP process 113 can include one or more of a topicclassification process that determines topics of messages and output oneor more topic NLP output parameter, a sentiment analysis process whichdetermines sentiment parameter for a message, e.g. polar sentiment NLPoutput parameters, “negative,” “positive,” and/or non-polar NLP outputsentiment parameters, e.g. “anger,” “disgust,” “fear,” “joy,” and/or“sadness” or other classification process for output of one or moreother NLP output parameters e.g. one of more “social tendency” NLPoutput parameter or one or more “writing style” NLP output parameter.

By running of NLP process 113 manager system 110 can perform a number ofprocesses including one or more of (a) topic classification and outputof one or more topic NLP output parameter for a received message (b)sentiment classification and output of one or more sentiment NLP outputparameter for a received message or (c) other NLP classifications andoutput of one or more other NLP output parameter for the receivedmessage.

Topic analysis for topic classification and output of NLP outputparameters can include topic segmentation to identify several topicswithin a message. Topic analysis can apply a variety of technologiese.g. one or more of Hidden Markov model (HMM), artificial chains,passage similarities using word co-occurrence, topic modeling, orclustering. Sentiment analysis for sentiment classification and outputof one or more sentiment NLP parameter can determine the attitude of aspeaker or a writer with respect to some topic or the overall contextualpolarity of a document. The attitude may be the author's judgment orevaluation, affective state (the emotional state of the author whenwriting), or the intended emotional communication (emotional effect theauthor wishes to have on the reader). In one embodiment sentimentanalysis can classify the polarity of a given text at the document,sentence, or feature/aspect level—whether the expressed opinion in adocument, a sentence or an entity feature/aspect is positive, negative,or neutral. Advanced sentiment classification can classify beyond apolarity of a given text. Advanced sentiment classification can classifyemotional states as sentiment classifications. Sentiment classificationscan include the classification of “anger,” “disgust,” “fear,” “joy,” and“sadness.”

Manager system 110 can run recognition process 114 to determine aclassification of an error associated to and resulting in display of acurrent error screen. Manager system 110 running recognition process 114can include manager system 110 examining data representing an errorscreen and/or context data of an error screen. Manager system 110running recognition process 114 to determine a classification of anerror associated to an error screen can include manager system 110recognizing a current error screen as a previously registered errorscreen and/or manager system 110 recognizing context data of an errorscreen as previously registered context data.

Manager system 110 running recognition process 114 can recognize acurrent error screen as a previously registered error screen based onone or more matching criterion being satisfied. Manager system 110running recognition process 114 can recognize context data of an errorscreen as a previously registered error screen context data based on oneor more matching criterion being satisfied. In one embodiment, amatching criterion can be satisfied when there is an identical matchbetween a current error screen and a previously registered error screen.In one embodiment, a matching criterion can be satisfied when there isother than an identical match.

In one embodiment, manager system 110 running recognition process 114 toexamine data representing error screen and/or context data of an errorscreen can include manager system 110 employing pattern recognitionprocessing using one or more of e.g. feature extraction algorithms,classification algorithms, and/or clustering algorithms.

In one embodiment, manager system 110 running recognition process 114 torecognize an error screen as a previously registered error screen caninclude performing of digital image processing for determining that amatching criterion has been satisfied. Digital image processing caninclude, e.g., filtering, edge detection, shape classification and/oroptical character recognition (OCR). Manager system 110 runningrecognition process can include, in one embodiment, activation of an NLPprocess 113 to identify a match between the current error screen and apreviously registered error screen based on one or more output NLPparameters resulting from an NLP processing of a prior-registered errorscreen as compared to a current error screen. An NLP processing forfacilitating performance of recognition process 114 can include use oftopic based NLP process, wherein topics of a current error screen iscompared to topic parameters of prior registered error screens forperformance of recognition processing and matching.

At various stages of operation, manager system 110 can run a heuristicprocess e.g. for performing matching of current error screen to apreviously registered error screen. In one embodiment, running ofheuristic process can include generating a hash of image data defining acurrent error screen and comparing that generated hash to hashes ofimage data representing registered. In some embodiments, manager system110 running recognition process can include running of heuristic processe.g. for comparing of a current error screen to a previously registerederror screen.

Manager system 110 running recognition process 114 to determine aclassification of an error associated to an error screen can includemanager system 110 matching a current error screen as a previouslyregistered error screen using one or more process set forth herein.According to one of more matching criterion, the matching can require anon-identical match or in some embodiment an identical match.

Manager system 110 running recognition process 114 to determine aclassification of an error associated to an error screen can includemanager system 110 matching context data of an error screen aspreviously registered context data. According to one of more matchingcriterion, the matching can require a non-identical match or in someembodiment an identical match. The context data can includeadministrator activity event context data associated to the event. Thecontext event can be time window related to the error screen. Forexample, if an error screen is displayed at time T1, a time window ofinterest may be defined by the time window T0 through T2 where T0 is atime before time T1 and T2 is a time after T1. For examination ofcontext data of an error screen manager system 110 running recognitionprocess 114 can employ pattern recognition processing using one or moreof e.g. feature extraction algorithms, classification algorithms, and/orclustering algorithms.

Manager system 110 running artificial intelligence (AI) action selectionprocess 115 can select one or more action based on a classification of acurrent error screen as having a certain error classification. In oneembodiment, manager system 110 running AI action selection process 115can include manager system 110 using a decision data structure ofdecision data structure area 2122. Manager system 110 running AI actionselection process 115 can include manager system 110 using decision datastructure that cognitively maps error classifier identifiers. One ormore actions that are specified in such a decision data structure caninclude, e.g. actions to install a patch on a particular softwareprogram running on one or more resource of resources 2602A-2602Z. One ormore action can also include activation of a logging profile for loggingdata of one or more resource of resources 2602A-2602Z. An actionspecified in a decision data structure can also include other actions,e.g. system resets, system reboots, reconfigurations, and the like.Actions can further include notifications, e.g. to an enterpriseadministrator associated to administrator client computer device 120and/or to a support administrator associated to service supportadministrator client computer device 170.

Manager system 110 running machine learning process 116 can includeapplication of training data to update actions specified in a decisiondata structure for use in running AI action selection process 115. Thetraining can include training of a predictive model that predicts a bestset of actions for responding to a current error screen. Training datacan include, e.g. a set of three-tuples, each three-tuple comprising forinstance the values (a_(i),s_(i),t_(i)) where a_(i) is an actioninstance, s_(i) is a success level associated to the action instance,and t_(i) is a time associated to an action instance.

FIG. 2 is a flowchart illustrating coordination of processes that can beperformed by manager system 110 of FIG. 1, in accordance with one ormore embodiments set forth herein.

At block 210, manager system 110 can run preparation and maintenanceprocess 111 to populate prepare and maintain various data of datarepository 112 including data of areas 2121-2124 of data repository 112.Manager system 110 can run preparation and maintenance process 111iteratively until process 111 is terminated at block 212.

At block 220, manager system 110 can run recognition process 114 todetermine error classifications for errors associated to error screens.For support of running of recognition process 114 iteratively, managersystem 110 can be running e.g. NLP process 113, and A.I. actionselection process 115 iteratively. Manager system 110 can runrecognition process 114 until recognition process 114 is terminated atblock 222. Manager system 110 can run preparation and maintenanceprocess 111 and recognition process 114 concurrently and can run each ofprocess 111 and process 114 iteratively NLP process 113 can be run e.g.to subject frames of image data to NLP processing to determine topicparameters associates to frames of image data for providing context datarecords for storage into error history area 2121.

A method 300 for performance by manager system 110 is illustrated withreference to FIG. 3. At block 310, manager system 110 can performobtaining iteratively captured frames of image data representing a userinterface screen, wherein one or more of the frames of image datarepresents an error screen indicating an error condition of one or moreresource of a plurality of resources of a services system. At block 320,manager system 110 can perform recognition processing using image dataof the captured frames of image data to determine an error classifierassociated to the error screen indicating an error condition of one ormore resource of a plurality of resources of a services system, whereinthe performing recognition processing includes using historical data ofa data repository, the historical data including data of past errors ofthe services system. At block 330 manager system 110 can performdetermining one or more action based on the error classifier, whereinthe determining includes using a decision data structure thatcognitively maps, for first through Nth error classifiers, an errorclassifier to at least one action associated to the error classifier. Atblock 340 manager system 110 can perform the one or more action inresponse to the determining, wherein the one or more action is an actionfor correction of the error condition indicated by the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system.

A specific example of method 300 is set forth in reference to theflowchart of FIG. 4, illustrating a specific example of method 300 fromthe perspective of manager system 110 having an associated datarepository 112, services system 160, administrator client computerdevice 120, camera 130, and service support administrator clientcomputer device 170.

At block 1601 services system 160 can send error data to administratorclient computer device 120 for receipt by administrator client computerdevice 120 at block 1201. During the performance of such sending anadministrator using administrator client computer device 120 can beperforming an operation with respect to one or more resource ofresources 2602A-2602Z of services system 160. In response to receipt ofthe error data at block 1201, administrator client computer device 120can display on a display thereof an error screen that indicates an errorcondition of the one or more resource.

An exemplary administrator user interface 500 for display on a displayof administrator client computer device 120, is shown in FIG. 5A.Administrator user interface 500 defines a user interface screen.Administrator user interface 500 can include an error history area 510that defines the displayed user interface 500 as an error screen. Inerror history area 510, there can be displayed content that indicates anerror. The content can include e.g. an error message. The error messagecan include e.g. text or describing a condition respecting e.g. anapplication of a resource of resources 2602A-2602Z.

In one embodiment, an error screen having an error message can be a userfriendly error screen that provides text based information respecting adetected problem. In another embodiment, an error screen need notcontain the user friendly text based message, but rather may include,e.g. merely an abnormal color, distortion, or something unexpected.

Error screens can be generated by resources of resources 2602A-2602Zincluding by applications running on one or more computing node. Errorscreen types can include for example: (a) a browser screen error screen(e.g. as depicted in FIG. 5B), including an error screen that directs toa 404 page; (b) an error dialog error screen (e.g. as depicted in FIG.5C) that specifies a dialog of errors; (c) a screen glitch error screene.g. as depicted in FIG. 5D; (d) a component positioning error screen asdepicted in FIG. 5E wherein a screen component is rendered at anincorrect location (in FIG. 5E the search interface is configured to becentered but instead is displayed in a lower right portion ofadministrator user interface 500); (e) functional error screen also asdepicted in FIG. 5E characterized by improper functioning of anapplication (a search engine search for “apples” returns “oranges”).

At block 1202, administrator client computer device 120 can send tomanager system 110 for receipt at block 1101 configuration selectiondata and screenshot data. Referring to administrator user interface 500,an administrator can be aware of a problem with respect to one or moreresource of resources 2602A-2602Z and accordingly may use area 520 toreport the problem. For example, an administrator may be aware of aproblem based on the content of an error message depicted in area 510.

An administrator user can use area 524 to enter a text based descriptionof an error associated to an error screen and may activate reportingusing area 520 with button 526. Manager system 110 in response to thereport activation can associate a ticket number to the reported errorassociated to an error screen. Manager system 110 in response to anerror being reported can activate sending of image data provided byiteratively captured of screenshots of administrator user interface 500.The image data can include a succession of screen shot frames at leastone of which can represent an error screen. Frames of the succession ofscreenshot frames can be taken at times earlier than a time at which anadministrator user reports a problem. For example, in one embodimentmanager system 110 can always be buffering a succession of screen shotframes, and then, when there is a problem reporting activation by anadministrator user, a succession of frames at block 1202 can be sent tomanager system 110.

The succession of frames can include frames captured within a timewindow of the error reporting activation. The time window can includetimes earlier than an error reporting activation time. In one examplethe time window T0-T2, where T1 is the error reporting activation time,T0 is earlier than T1 and is a time of the first frame of the successionof frames, and T2 is later than or equal to T1 and is the time of thelast frame of the succession of frames. The iteratively captured imagedata provided by screenshot data on receipt by manager system 110 atblock 1103 can be sent by manager system 110 at block 1122 for receiptand storage by data repository 112 at block 1122. Such stored image datacan be stored e.g. error history area 2121 as context indicating acontext of an error screen.

The iteratively captured screen shots with configuration selection data,e.g. of selection data to select a reported problem can be sent at block1202 for receipt by manager system 110 at block 1101. In one embodiment,screenshot data can be passively received by manager system 110 at block1101 without a problem reporting being activated by an administratoruser. In such an embodiment, manager system 110 can passively processreceived screenshot data in the background without an administrator userperforming reporting using administrator user interface 500.

In another aspect, image data representing an error screen and otheruser interface screens can be captured using an external image capturedevice, i.e. a camera 130. As depicted in FIG. 1, camera 130 can includea video formatter process 2301 for formatting captured image data intostreaming video format. Camera 130 at block 1301 can send streamingvideo data to manager system 110 for receipt by manager system 110 atblock 1103. Responsively, to receipt of the video data, manager system110 at block 1104 can send received video data to data repository 112for receipt and storage by data repository 112 at block 1122. Suchstored image data can be stored e.g. error history area 2121 as contextindicating a context of an error screen.

In one embodiment, manager system 110 can subject iteratively capturedframe image data received at block 1101 and/or 1103 to furtherprocessing to enhance data representing error screens and user interfacescreens absent of error screen areas and to provide context dataassociated to error screen. For example, manager system 110 can subjecttimestamped frames of the successive image data frame screen shot framesand/or video frames to e.g. OCR processing to transform image datarepresentations of text into machine readable text and then can furthersubject OCR processed frames to further processing e.g. by NLP process113 to return topic classifications for each frame. Manager system 110can append the provided context data to the iteratively captured framesand can store the context data with the image data into error historyarea 2121 of data repository 112. Data stored in error history area 2121can be time stamped to facilitate time window processing. Context dataassociated to an error screen can include data other than datarepresenting an error screen, e.g. can include data of or provided usingimage data frames representing user interface screens captured prior totime of a display of an error screen. Context data associated to anerror screen can include administrator activity event context data thatindicates activity events of an administrator used within a time windowassociated to an error screen.

Recognizing at block 1105 can include activation of recognition process114 as set forth herein to classify an error associated to an errorscreen. Recognizing can include iterative queries of data repository 112as depicted by query receive and respond block 1123 performed by datarepository 112.

Recognizing at block 1105 to classify a current error associated to acurrent error screen can include examining of one or more of (a) errorscreen data representing an error screen or (b) context data associatedto the error screen. Error screen data representing an error screen caninclude or be obtained using image data frames representing an errorscreen. Context data of an error screen can include or be obtained usingimage data frames representing user interface screens captured within atime window associated to an error screen. Such user interface screenscan be absent of an error screen area e.g. can user interface screensindicating administrator user activity within a time window associatedto an error screen, e.g. preceding display of an error screen.

Manager system 110 can run recognition process 114 to determine aclassification of an error associated to and resulting in display of acurrent error screen. Manager system 110 running recognition process 114can include manager system 110 examining data representing an errorscreen and/or context data of an error screen. Manager system 110running recognition process 114 to determine a classification of anerror associated to an error screen can include manager system 110determining that a current error screen matches a previously registerederror screen and/or manager system 110 determining that context data ofa current error screen matches previously registered context data.

Manager system 110 running recognition process 114 can recognize acurrent error screen as a previously registered error screen based onone or more matching criterion being satisfied. Manager system 110running recognition process 114 can recognize context data of an errorscreen as a previously registered error screen context data based on oneor more matching criterion being satisfied. In one embodiment, amatching criterion can be satisfied when there is an identical matchbetween a current error screen and a previously registered error screen.In one embodiment, a matching criterion can be satisfied when there isother than an identical match.

In one embodiment, manager system 110 running recognition process 114 toexamine data representing error screen and/or context data of an errorscreen can include manager system 110 employing pattern recognitionprocessing using one or more of e.g. feature extraction algorithms,classification algorithms, and/or clustering algorithms.

In one embodiment, manager system 110 running recognition process 114 torecognize an error screen as a previously registered error screen caninclude performing of digital image processing for determining that amatching criterion has been satisfied. Digital image processing caninclude, e.g., filtering, edge detection, shape classification and/oroptical character recognition (OCR). Manager system 110 runningrecognition process can include, in one embodiment, activation of an NLPprocess 113 to identify a match between the current error screen and apreviously registered error screen based on one or more output NLPparameters resulting from an NLP processing of a prior-registered errorscreen as compared to a current error screen. An NLP processing forfacilitating performance of recognition process 114 can include use oftopic based NLP process, wherein topics of a current error screen iscompared to topic parameters of prior registered error screens forperformance of recognition processing and matching.

At various stages of operation, manager system 110 can run a heuristicprocess e.g. for performing matching of current error screen to apreviously registered error screen. In one embodiment, running ofheuristic process can include generating a hash of image data defining acurrent error screen and comparing that generated hash to hashes ofimage data representing registered. In some embodiments, manager system110 running recognition process can include running of heuristic processe.g. for comparing of a current error screen to a previously registerederror screen.

Manager system 110 running recognition process 114 to determine aclassification of an error associated to an error screen can includemanager system 110 recognizing a current error screen as a previouslyregistered error screen using one or more process set forth herein.

Manager system 110 running recognition process 114 to determine aclassification of an error associated to an error screen can includemanager system 110 recognizing context data of an error screen aspreviously registered context data. The context data can includeadministrator activity event context data associated to the event. Thecontext event can be time window related to the error screen. Forexample, if an error screen is displayed at time T1, a time window ofinterest may be defined by the time window T0 through T2 where T0 is atime before time T1 and T2 is a time after T1. For examination ofcontext data manager system 110 running recognition process 114 canemploy pattern recognition processing using one or more of e.g. featureextraction algorithms, classification algorithms, and/or clusteringalgorithms.

Recognizing at block 1105 to classify a current error associated to acurrent error screen can include examining of one or more of (a) errorscreen data or (b) context data associated to the error screen data.Examining according to (a) can include determining that a current errorscreen matches a prior registered error screen according to a matchingcriterion wherein the current error screen and a prior error screen neednot be identical. Examining according to (b) can include determiningthat an error associated to a current error screen matches a priorregistered context data for the error according to a matching criterionwherein context data of the current error and the prior registeredcontext data need not be identical.

Manager system 110 can employ various processes for determining thatthere is a match between a current error screen and a prior registerederror screen. In one embodiment, manager system 110 running recognitionprocess 114 can include performing of digital image processing fordetermining that a matching condition has occurred. Digital imageprocessing can include, e.g., filtering, edge detection, and/or opticalcharacter recognition (OCR). Manager system 110 running recognitionprocess 114 can include, in one embodiment, use of NLP parametersreturned by activation of an NLP process 113 to identify a match betweenthe current error screen and a previously registered error screen basedon one or more output NLP parameters resulting from an NLP processing ofa prior-registered error screen as compared to a current error screen.An NLP processing for facilitating performance of recognition process114 can include use of topic based NLP process, wherein topics of acurrent error screen is compared to topic parameters of prior registerederror screens for performance of recognition processing and matching. Atvarious stages of operation, manager system 110 can run a heuristicprocess e.g. for performing matching of current error screen to apreviously registered error screen. In one embodiment, running ofheuristic process can include generating a hash of image data defining acurrent error screen and comparing that generated hash to hashes ofimage data representing registered. In some embodiments, manager system110 running recognition process can include running of heuristic processe.g. for comparing of a current error screen to a previously registerederror screen.

In some embodiments, for classifying an error associated to an errorscreen, manager system 110 can examine context data associated to anerror screen. Error screen data stored in error history area 2121 ofdata repository 112 can include data representing an error screen andcontext data associated to an error screen. The context data can includee.g. administrator activity event context data associated to an errorscreen. The context data can include administrator activity event dataassociated to times within a time window related to the error screen.For example, if an error screen is displayed at time T1, a time windowof interest associated to the error screen may be defined by the timewindow T0 through T2 where T0 is a time before time T1 and T2 is a timeequal to or after T1. Data stored in error history area 2121 can be timestamped to facilitate time window processing. Context data associated toan error screen can include data other than data representing an errorscreen, e.g. can include data of or provided using image data framescaptured prior to a time of a display of an error screen.

Context data subject to examining for classifying an error associated toan error screen can include data indicating administrator activityevents within a time window associated to an error screen. Embodimentherein recognize that errors with services system resources such asresources 2602-2602Z can be classified as common where the error havecommon administrator activity events between the errors. Accordingly,for classifying an error associated to an error screen manager system110 can examine administrator activity event context data to determinethat there is a match between context data of a current error screen andprior registered context data. Such context data can be stored in errorhistory area 2121 of data repository 112 by processes set forth hereinand can include iterative timestamped frame image data, OCR output data,and/or NLP parameter data.

To illustrate error screen context data based error classificationaccording one embodiment, manager system 110 can perform the followingat block 1105: (i) iteratively captured frames received at block 1101and/or 1103 can be examined as a set of frames comprising 1000 frameswithin the described time window T0 to T2 where an error screen isdisplayed at time T1: (ii) manager system 110 can recognize that inframe 9 the administrator user visited their favorites; (iii) managersystem 110 can recognize that in frame 323 the user toggled a setting;(iv) manager system 110 can recognize that in frame 423 the userperformed a search; (v) manager system 110 can recognize that beginningin frame 557 error screen ES008 was displayed.

Based on the administrator activity events, manager system 110 cansearch past error history area 2121 for past registered error contextdata matching the current error context data characterized by a sequenceof administrator activity events comprising the events: (a) visitingfavorites; (b) toggling setting; and (c) performing a search. In someembodiment, manager system 110 can filter results to exclude resultswhere the error screen ES008 is not subsequently displayed on a displayof administrator client computer device 120.

Manager system 110 can examine error history area 2121 and can identifyprior registered context data wherein at frame 27 an administrator uservisited a favorite, at frame 90 toggled settings and at frame 192performed a search. Manager system 110 can determine that the priorregistered error screen context data matches the current error screencontext data based on the administrator activity event sequence (a) (b)and (c) being in common between the prior registered error screencontext data and the current error screen context data.

Matching determinations can be qualified by a confidence level exceedinga threshold which confidence level can be based e.g. on the frame countvariance between the prior registered error screen context data and thecurrent error screen context data. Manager system 110 based on adetermining that a current error screen context data matches prior errorscreen context data can assign an error classifier to the current errorhaving an associated error screen.

Manager system 110 at block 1106 can determine whether a match has beenidentified between current error data and a previously registered errordata, e.g. between a current error screen and/or context data and aprior registered error screen and/or error screen context data. Managersystem 110 based on a match not being detected, can proceed to block1107 to provide one or more output. The one or more output can be a newerror type notification sent by manager system 110 at block 1107 forreceipt by service support administrator client computer device 170 atblock 1701. Based on the receipt of the new error type notification atblock 1701, an administrator associated to service support administratorclient computer device 170, an administrator user can use a supportadministrator user interface 600 as is depicted in FIG. 6 to specifydata to initialize a new error classification for the new errorspecified in the notification received at block 1701, as well as aninitial set of actions associated to the new error classification.Manager system 110 to register the new error as a registered error canassign a new error classifier identifier to the new error having errordata stored in error history area 2121 (e.g. data representing an errorscreen and error screen context data) for which no prior matching errordata was found. A registered error can have a registered error screenand registered context data stored in error history area 2121. Usingerror area 610 a support administrator using support administrator userinterface 600 can observe a re-presentment of the current error screenin area 620 and/or context data associated to the error screen and usingdropdown menu at 630 can specify one or more patch for association withthe new error type. A support administrator user can specify one or morelogging profile associated to the new error type using area 632 andusing the dropdown menu at 632 a support administrator user can specifyone or more other action associated to the new error classification.

Based on a matching being performed at block 1106 so that an errorclassifier is determined for an error, manager system 110 can proceed toblock 1108 to perform action selection. System 100 can be configured sothat action selection at block 1108 can also be performed in response toa support administrator user initializing a new error classification andactions at block 1702 using support administrator user interface 600.Manager system 110 can perform action selection at block 1108 using adecision data structure as set forth in Table A.

TABLE A ERROR PATCH LOGGING PROFILE OTHER ACTION E001 P007; P009 L004A002 E002 P002 L003; L006 A004 E003 — L009; L007 — E004 P003; P001; P006L003 A002, A008 . . . . . . . . . . . .Table A depicts a cognitive mapping decision data structure thatcognitively maps error classifications, e.g. error classificationsidentified by the identifiers E001, E002, E003, E004 to actionsassociated to the error classification. Various types of actions can bespecified in the decision data structure including patch actions havingidentifiers in the form P00*, logging profile action identifiers havingthe form L00*, and other action identifiers having the form A00*.Referring to the decision data structure of Table A, manager system 110on determining that a current error screen having an associated errorclassification classified by the classifier E003 and can return adecision to initiate patch P007 and logging profiles L009 and L007.

In the described example hereinabove wherein manager system 110determines that a current error context data matches prior registerederror context data based on the administrator activity event sequence(a), (b) and (c) being common between the error context data, managersystem 110 can determine that the current error is the classified aserror classification E002 that is specified in Table A. Manager system110 can accordingly return the decision for action P002 to install acertain patch to correct the condition indicated by the error screenassociated to an error. Manager system 110 can accordingly furtherreturn the decision for actions to activate the logging profiles L003,and L006 which are logging profiles to activate logging for “favorites”and logging for “search feature” respectively. Manager system 110 canaccordingly also return the action A004 to send a text based messagespecifying that the administrator user re-perform the activity events(the favorites and search activities) preceding the error screen withlogging now activated.

Other actions specified in the other actions column of the decision datastructure of Table A can include e.g. a restart of an application of aresource of one or more resources 2602A-2602Z such as a web basedapplication, or a restart of a microservice.

Manager system 110 at block 1109 can provide one or more output inresponse to the action selection by manager system 110 at block 1108.The one or more output at block 1109 can include manager system 110sending text based action selection data and/or profiling questions forreceipt by administrator client computer device 120 at block 1203. Onreceipt of action selection data at block 1203, administrator clientcomputer device 120 can display in area 540 of administrator userinterface 500 various data. For example, at 541 of area 540administrator user interface 500 can display textual data describingaspects of a selected one or more patch selected at block 1108. Area 542indicators for various patches can be displayed highlighting one or morepatch selected by the action selection process at block 1108. Using area544 an administrator user can specify an address, e.g. URL for theselected patch. In response to receipt of the action selection data atblock 1203 there can also be displayed within area 540 of administratoruser interface 500, a text based description of a selected loggingprofile selected by the performing of action selection at block 1108. Inarea 552 there can be displayed various icons for menu selection of alogging profile. With the selected logging profile, selected by theaction selection at block 1108 being highlighted. Using area 554, andadministrator user can designate an address, e.g. URL for performance ofthe logging profile activation. Area 540 depicts a guided automatedselection in which an administrator user can enter manual controls intoa user interface that are guided by the performance of action selectionat block 1108. In some embodiments, manager system 110 can be configuredto automatically implement in accordance with an action selection atblock 1108 without a guided automatic selection using an administratoruser interface, such as administrator user interface 500. For example,manager system 110 at block 1109 for providing one or more output inresponse to the performance of action selection at block 1108 can sendone or more patch and one or more set of logging profile configurationdata for receipt by services system 160 at block 1603 without anyadministrator user interaction with administrator user interface 500 forinstalling of the selected one or more patch and/or activating of theone or more logging profile.

Manager system 110 can in many use case scenarios automaticallydetermines an address location (e.g. URL) to which to transmit acorrective patch for installation for correction of an indicatedcondition indicated by an error screen. For example, error screenscommonly map to applications having software running on computing nodeswith locations which can be readily tracked e.g. with use of one or moreIT management system 2604. Manager system 110 can automatically send apatch for installation to an automatically determined installationlocation. The automatic sending can be on a guided automated basis or anunguided automatic basis (without any administrator user interactionwith administrator user interface 500) for example.

Manager system 110 can in many use case scenarios automaticallydetermine a location to which to transmit a corrective logging profileactivation communication to activate a logging profile. For example,error screens commonly map to applications having software running oncomputing nodes with locations which can be readily tracked e.g. withuse of one or more IT management system 2604. On recognition of anerror, manager system 110 can automatically send a REST request to a logmanagement system (e.g. Graylog) or the application itself to enableadditional logging for that particular component. A logging profileaction that is specified in a decision data structure as described inconnection with Table A can be a logging profile to increase aspecificity of a logging function. For example, according to a baselinelogging function, logging operations for improved memory utilization maynot log events mapped to particular user interface controls (e.g. hotbuttons). However, according to a debug logging profile, user interfacecontrol specific events (e.g. mapping to a particular control button)can be tracked. A logging profile activation decision specified in adecision data structure, e.g. as shown in Table A can include a loggingprofile activation decision to activate a debug logging profile. Alogging profile can be seen as a set of logging rules. For example, inthe program code when a user clicks ButtonA with debug logging on, themessage “user clicked ButtonA”. Since a user may click ButtonA 1000times a day avoiding logging such detail may be advantageous forimprovement of memory utilization. In such an embodiment, system 100 canselectively provide such a log on the activation of a debug loggingprofile.

One or more output provided at block 1109 by manager system 110 canfurther include a communication by manager system 110 for receipt byservices support administrator client computer device 170 at block 1703.Such a communication can include, e.g. text based action selection datawhich provides data on the action decision selection provided at block1108. Such action selection data can include e.g. text based descriptionof the action decisions returned with use of a decision data structurefor display on a support user interface displayed on a display ofservices support administrator client computer device 170.

In response to received action selection data received at block 1703,support administrator user interface 600 as shown in FIG. 6 can displayvarious content in area 640 of support administrator user interface 600.Such content can include, e.g. at 642 a text based description of theaction selections resulting from performance of action selection block1108. The support administrator user associated to service supportadministrator client computer device 170, accordingly has information ofthe action selections resulting from performance of block 1108. In area644, there can be displayed, e.g. a face-to-face video communicationchannel to facilitate video communication between the supportadministrator at the service support administrator client computerdevice 170 and the enterprise administrator at administrator clientcomputer device 120. Additionally, or alternatively, in area 644 therecan be displayed a shared work screen facilitating further communicationbetween administrators regarding the current error screen, displayed ona display of administrator client computer device 120. One or moreoutput provided at block 1109 can include one or more output to activateperformance evaluation if any action implemented based on the actionselection at block 1108. The monitoring can include scoring ofperformance of the action based on various selected performanceparameters, e.g. system down town, system run time. Such resourceperformance monitoring data can be obtained from one or more ITmanagement system 2604.

One or more output to initiate a monitoring process for monitoringperformance of a selected action selected at block 1108 can includemanager system 110 sending a communication to administrator clientcomputer device 120, so that a survey 560 is displayed on administratoruser interface 500 as shown in FIG. 5. The displayed survey 560 caninclude various information input information areas that allow anadministrator user using administrator user interface 500 to specify asuccess rating of the selected action, e.g. on a scale of 0 (notsuccessful) to 10 (most successful). On the generating monitoringresults data that specifies a success rating of a selected action, suchdata can be used to automatically update a decision data structure.

With further reference to the flowchart of FIG. 4, machine learning canbe performed at block 1110. Machine learning can include activation ofmachine learning process 116 as depicted in FIG. 1. Machine learning caninclude use of data resulting from the described performance monitoringto update data of a decision data structure. Iteratively, over time asadditional data is obtained by system 100. FIG. 7 illustrates apredictive model that can be trained by activation of machine learningprocess 116 for updating actions specified in a decision data structure,such as the decision data structure as set forth in Table A. Depicted inFIG. 7, training data for training of predictive model can includeinputting a set of three-tuples into machine learning process 1017. Eachthree-tuple can take the form of (a_(i), s_(i), t_(i)) where a_(i) is anaction instance, s_(i) is a success rating associated to the actioninstance, and t_(i) is a time associated to the action instance. Thetraining data input into machine learning process 1017 can iterate asnew data is made available. For example, where a certain error data(e.g. error screen data and/or context data thereof) is matched to apreviously registered error screen and the error classified according toa classification actions can be selected for the classification andsubsequent to the actions being implemented, performance of the actionscan be monitored for the determining success ratings. On the return bysystem 100 of each new success rating parameter, manager system 110 canautomatically apply updated training data to machine learning process116 which can responsively update a predictive model for predicting abest performing set of actions for the certain error classification.Machine learning process 116 based on the applied training data canoutput a prioritized list of actions, e.g. the actions AR1, AR2, . . . .Where AR1 is the highest ranking action, AR2 is the second highestranking action, and so forth according to a prioritized list of actions.

In one embodiment, machine learning process 116 can apply an algorithmso that the output prioritized list of actions can change based on inputtraining data. In one embodiment the algorithm can provide a ranking ofprioritized actions based on an average of success ratings for thevarious actions, in accordance with a function that uses the timestampparameter of the training data to filter out aged data older than athreshold age.

Certain embodiments herein may offer various technical computingadvantages involving computing advantages to address problems arising inthe realm of computer networks. Embodiments herein can performrecognition processing to determine classification of errors associatedto error screens indicating an error condition of one or more resourceof a services system. One or more decision data structure can be used toreturn artificial intelligence (AI) decisions based on returned errorclassifiers. Machine learning processes can be employed, such as machinelearning process to automatically update a decision data structure thatcognitively maps error classifiers to actions associated to the errorclassifiers. Embodiments herein feature AI decision making processes forimplementation of one or more corrective action in response torecognizing an error having an associated error screen. Correctiveactions that can be implemented in response to recognizing an error caninclude, e.g. action for software patch installation and/or action forlogging profile activation. Machine learning processes can be performedfor increased accuracy and for reduction of reliance on rule basedcriteria and thus, reduced computational overhead. For enhancement ofcomputation accuracies, embodiments can feature computational platformsexisting only in the realm of computer networks such as artificialintelligence (AI) platforms and machine learning platforms. Embodimentsherein can employ data structuring processes, e.g. processing fortransforming unstructured data into a form optimized for computerizedprocessing. Embodiments herein for recognizing a error screen caninclude, e.g. activation of a heuristic process and/or utilization ofreturn data returned by subjecting of an error screen to naturallanguage processing (NLP) processes. Embodiments herein recognize thatwith administrator users increasingly working remotely with respect tonetwork resources, such administrator users are increasingly usingadministrator user computer devices that are mobile devices having smallscreens. Embodiments herein can feature simplified and reduced content,user interface control features, and in various embodiments can avoidprocesses involving manual input to enhance an administrator's abilityto perform administrative activities with respect to a network using anadministrator computer device provided by a mobile device having a smallscreen.

FIGS. 8-10 depict various aspects of computing, including a computersystem and cloud computing, in accordance with one or more aspects setforth herein.

It is understood in advance that although this disclosure includes adetailed description on cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

Referring now to FIG. 8, a schematic of an example of a computing nodeis shown. Computing node 10 is only one example of a computing nodesuitable for use as a cloud computing node and is not intended tosuggest any limitation as to the scope of use or functionality ofembodiments of the invention described herein. Regardless, computingnode 10 is capable of being implemented and/or performing any of thefunctionality set forth hereinabove. Computing node 10 can beimplemented as a cloud computing node in a cloud computing environment,or can be implemented as a computing node in a computing environmentother than a cloud computing environment.

In computing node 10 there is a computer system 12, which is operationalwith numerous other general purpose or special purpose computing systemenvironments or configurations. Examples of well-known computingsystems, environments, and/or configurations that may be suitable foruse with computer system 12 include, but are not limited to, personalcomputer systems, server computer systems, thin clients, thick clients,hand-held or laptop devices, multiprocessor systems,microprocessor-based systems, set top boxes, programmable consumerelectronics, network PCs, minicomputer systems, mainframe computersystems, and distributed cloud computing environments that include anyof the above systems or devices, and the like.

Computer system 12 may be described in the general context of computersystem-executable instructions, such as program processes, beingexecuted by a computer system. Generally, program processes may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system 12 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program processes may belocated in both local and remote computer system storage media includingmemory storage devices.

As shown in FIG. 8, computer system 12 in computing node 10 is shown inthe form of a computing device. The components of computer system 12 mayinclude, but are not limited to, one or more processor 16, a systemmemory 28, and a bus 18 that couples various system components includingsystem memory 28 to processor 16. In one embodiment, computing node 10is a computing node of a non-cloud computing environment. In oneembodiment, computing node 10 is a computing node of a cloud computingenvironment as set forth herein in connection with FIGS. 9-10.

Bus 18 represents one or more of any of several types of bus structures,including a memory bus or memory controller, a peripheral bus, anaccelerated graphics port, and a processor or local bus using any of avariety of bus architectures. By way of example, and not limitation,such architectures include Industry Standard Architecture (ISA) bus,Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, VideoElectronics Standards Association (VESA) local bus, and PeripheralComponent Interconnects (PCI) bus.

Computer system 12 typically includes a variety of computer systemreadable media. Such media may be any available media that is accessibleby computer system 12, and it includes both volatile and non-volatilemedia, removable and non-removable media.

System memory 28 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 30 and/or cachememory 32. Computer system 12 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 34 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM or other optical media can be provided.In such instances, each can be connected to bus 18 by one or more datamedia interfaces. As will be further depicted and described below,memory 28 may include at least one program product having a set (e.g.,at least one) of program processes that are configured to carry out thefunctions of embodiments of the invention.

One or more program 40, having a set (at least one) of program processes42, may be stored in memory 28 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram processes, and program data. One or more program 40 includingprogram processes 42 can generally carry out the functions set forthherein. In one embodiment, manager system 110 can include one or morecomputing node 10 and can include one or more program 40 for performingfunctions described with reference to method 200 of FIG. 2 and functionsdescribed with reference to method 300 of FIG. 3 and functions describedwith reference to manager system 110 as set forth in the flowchart ofFIG. 4. In one embodiment, services system 160 can include one or morecomputing node 10 and can include one or more program 40 for performingfunctions described with reference to services system 160 as set forthin the flowchart of FIG. 4. In one embodiment, administrator clientcomputer device 120 can include one or more computing node 10 and caninclude one or more program 40 for performing functions described withreference to administrator client computer device 120 as set forth inthe flowchart of FIG. 4. In one embodiment, service supportadministrator client computer device 170 can include one or morecomputing node 10 and can include one or more program 40 for performingfunctions described with reference to service support administratorclient computer device 170 as set forth in the flowchart of FIG. 4. Inone embodiment, the computing node based systems and devices depicted inFIG. 1 can include one or more program for performing function describedwith reference to such computing node based systems and devices.

Computer system 12 may also communicate with one or more externaldevices 14 such as a keyboard, a pointing device, a display 24, etc.;one or more devices that enable a user to interact with computer system12; and/or any devices (e.g., network card, modem, etc.) that enablecomputer system 12 to communicate with one or more other computingdevices. Such communication can occur via Input/Output (I/O) interfaces22. Still yet, computer system 12 can communicate with one or morenetworks such as a local area network (LAN), a general wide area network(WAN), and/or a public network (e.g., the Internet) via network adapter20. As depicted, network adapter 20 communicates with the othercomponents of computer system 12 via bus 18. It should be understoodthat although not shown, other hardware and/or software components couldbe used in conjunction with computer system 12. Examples, include, butare not limited to: microcode, device drivers, redundant processingunits, external disk drive arrays, RAID systems, tape drives, and dataarchival storage systems, etc. In addition to or in place of havingexternal devices 14 and display 24, which can be configured to provideuser interface functionality, computing node 10 in one embodiment caninclude display 25 connected to bus 18. In one embodiment, display 25can be configured as a touch screen display and can be configured toprovide user interface functionality, e.g. can facilitate virtualkeyboard functionality and input of total data. Computer system 12 inone embodiment can also include one or more sensor device 27 connectedto bus 18. One or more sensor device 27 can alternatively be connectedthrough I/O interface(s) 22. One or more sensor device 27 can include aGlobal Positioning Sensor (GPS) device in one embodiment and can beconfigured to provide a location of computing node 10. In oneembodiment, one or more sensor device 27 can alternatively or inaddition include, e.g., one or more of a camera, a gyroscope, atemperature sensor, a humidity sensor, a pulse sensor, a blood pressure(bp) sensor or an audio input device. Computer system 12 can include oneor more network adapter 20. In FIG. 9 computing node 10 is described asbeing implemented in a cloud computing environment and accordingly isreferred to as a cloud computing node in the context of FIG. 9.

Referring now to FIG. 9, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 comprises one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 9 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 10, a set of functional abstraction layersprovided by cloud computing environment 50 (FIG. 9) is shown. It shouldbe understood in advance that the components, layers, and functionsshown in FIG. 10 are intended to be illustrative only and embodiments ofthe invention are not limited thereto. As depicted, the following layersand corresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and processing components 96 for performingrecognition processing to classify errors associated to error screensand to perform associated processing as set forth herein. The processingcomponents 96 can be implemented with use of one or more program 40described in FIG. 8.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowcharts and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting. As used herein, thesingular forms “a,” “an,” and “the” are intended to include the pluralforms as well, unless the context clearly indicates otherwise. It willbe further understood that the terms “comprise” (and any form ofcomprise, such as “comprises” and “comprising”), “have” (and any form ofhave, such as “has” and “having”), “include” (and any form of include,such as “includes” and “including”), and “contain” (and any form ofcontain, such as “contains” and “containing”) are open-ended linkingverbs. As a result, a method or device that “comprises,” “has,”“includes,” or “contains” one or more steps or elements possesses thoseone or more steps or elements, but is not limited to possessing onlythose one or more steps or elements. Likewise, a step of a method or anelement of a device that “comprises,” “has,” “includes,” or “contains”one or more features possesses those one or more features, but is notlimited to possessing only those one or more features. Forms of the term“based on” herein encompass relationships where an element is partiallybased on as well as relationships where an element is entirely based on.Methods, products and systems described as having a certain number ofelements can be practiced with less than or greater than the certainnumber of elements. Furthermore, a device or structure that isconfigured in a certain way is configured in at least that way, but mayalso be configured in ways that are not listed.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below, if any, areintended to include any structure, material, or act for performing thefunction in combination with other claimed elements as specificallyclaimed. The description set forth herein has been presented forpurposes of illustration and description, but is not intended to beexhaustive or limited to the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the disclosure. Theembodiment was chosen and described in order to best explain theprinciples of one or more aspects set forth herein and the practicalapplication, and to enable others of ordinary skill in the art tounderstand one or more aspects as described herein for variousembodiments with various modifications as are suited to the particularuse contemplated.

What is claimed is:
 1. A method comprising: obtaining iterativelycaptured frames of image data representing a user interface screen,wherein one or more of the frames of image data represents an errorscreen indicating an error condition of one or more resource of aplurality of resources of a services system; performing recognitionprocessing using image data of the captured frames of image data todetermine an error classifier associated to the error screen indicatingan error condition of one or more resource of a plurality of resourcesof a services system, wherein the performing recognition processingincludes using historical data of a data repository, the historical dataincluding data of past errors of the services system; determining one ormore action based on the error classifier, wherein the determiningincludes using a decision data structure that cognitively maps, forfirst through Nth error classifiers, an error classifier to at least oneaction associated to the error classifier; and performing the one ormore action in response to the determining, wherein the one or moreaction is an action for correction of the error condition indicated bythe error screen indicating an error condition of one or more resourceof a plurality of resources of a services system, wherein the performingrecognition processing includes determining that a current error screenmatches a prior registered error screen, and wherein the determiningincludes using an image hash of the current error screen and an imagehash of a prior registered error screen.
 2. The method of claim 1,wherein the one or more action includes automatically installing asoftware patch to a software program associated to a services systemresource.
 3. The method of claim 1, wherein the one or more actionincludes automatically installing a software patch to a software programassociated to a services system resource based on one or manuallyentered input by an administrator user in response to one or more promptdisplayed on a displayed administer user interface associated to theadministrator user.
 4. The method of claim 1, wherein the one or moreaction is an action to activate a logging profile for logging activityof a services system.
 5. The method of claim 1, wherein the methodincludes monitoring performance of the one or more action to yield asuccess rating parameter of the one or more action, applying the successrating parameter to a machine learning process, and updating thedecision data structure using an output of the machine learning process.6. The method of claim 1, wherein the method includes in response to afailure of performing recognition to determine the error classifier,sending a communication to a support administrator user prompting actionby the support administrator user to register a new error classifier. 7.The method of claim 1, wherein the method includes in response to theperforming recognition processing opening a communication channelbetween a customer administrator user and a support administrator user,and wherein the performing the one or more action includes sending textbased action selection data to the customer administrator user and thesupport administrator user.
 8. The method of claim 1, wherein theperforming recognition processing includes determining that a currenterror screen matches a prior registered error screen.
 9. The method ofclaim 1, wherein the performing recognition processing includesdetermining that a current error screen matches a prior registered errorscreen, wherein the determining includes using Natural LanguageProcessing (NLP) parameters obtained by subjecting the current errorscreen to NLP processing, and using Natural Language Processing (NLP)parameters obtained by subjecting the prior registered error screen toNLP processing.
 10. The method of claim 1, wherein the performingrecognition processing includes determining that context data of anerror associated to a current error screen matches prior registeredcontext data of a prior registered error screen, wherein the contextdata of the error associated to the current error screen indicates acertain sequence of activity events by an administrator user, andwherein the prior registered context data of the prior registered errorscreen commonly indicates the same certain sequence of activity eventsby an administrator user.
 11. The method of claim 1, wherein the one ormore action includes automatically installing a software patch to asoftware program associated to the error condition of one or moreresource of a plurality of resources of the services system, wherein theautomatically installing includes automatically sending the softwarepatch to a proper address location using data returned by an ITmanagement system of the services system that tracks a current locationof the software program, wherein the method includes in response to theperforming recognition processing opening a communication channelbetween a customer administrator user and a support administrator user,and wherein the performing the one or more action includes sending textbased action selection data to the customer administrator user and thesupport administrator user.
 12. The method of claim 1, wherein themethod includes in response to a failure of performing recognition todetermine the error classifier, sending a communication to a supportadministrator user prompting action by the support administrator user toregister a new error classifier, wherein the performing recognitionprocessing includes determining that a current error screen matches aprior registered error screen, wherein the determining includes usingNatural Language Processing (NLP) parameters obtained by subjecting thecurrent error screen to NLP processing, and using Natural LanguageProcessing (NLP) parameters obtained by subjecting the prior registerederror screen to NLP processing, and wherein the obtaining iterativelycaptured frames of image data representing a user interface screenincludes obtaining the iteratively captured frames in response to anerror report activation by an administrator user using an administratoruser interface defining the user interface screen, wherein theadministrator user interface is displayed on an administrator clientcomputer device that continuously buffers screen shots of the userinterface screen, wherein the obtaining iteratively captured frames ofimage data representing a user interface screen includes obtainingscreen shots of the buffered screen shots having capture times prior toa time of the error report activation by the administrator user.
 13. Acomputer program product comprising: a computer readable storage mediumreadable by one or more processing circuit and storing instructions forexecution by one or more processor for performing a method comprising:obtaining iteratively captured frames of image data representing a userinterface screen, wherein one or more of the frames of image datarepresents an error screen indicating an error condition of one or moreresource of a plurality of resources of a services system; performingrecognition processing using image data of the captured frames of imagedata to determine an error classifier associated to the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system, wherein the performing recognitionprocessing includes using historical data of a data repository, thehistorical data including data of past errors of the services system;determining one or more action based on the error classifier, whereinthe determining includes using a decision data structure thatcognitively maps, for first through Nth error classifiers, an errorclassifier to at least one action associated to the error classifier;and performing the one or more action in response to the determining,wherein the one or more action is an action for correction of the errorcondition indicated by the error screen indicating an error condition ofone or more resource of a plurality of resources of a services system,wherein the performing recognition processing includes determining thata current error screen matches a prior registered error screen, andwherein the determining includes using an image hash of the currenterror screen and an image hash of a prior registered error screen. 14.The computer program product of claim 13, wherein the performingrecognition processing includes determining that context data of anerror associated to a current error screen matches prior registeredcontext data of a prior registered error screen, wherein the contextdata of the error associated to the current error screen indicates acertain sequence of activity events by an administrator user, andwherein the prior registered context data of the prior registered errorscreen commonly indicates the same certain sequence of activity eventsby an administrator user.
 15. The computer program product of claim 13,wherein the one or more action includes automatically installing asoftware patch to a software program associated to the error conditionof one or more resource of a plurality of resources of the servicessystem, wherein the automatically installing includes automaticallysending the software patch to a proper address location using datareturned by an IT management system of the services system that tracks acurrent location of the software program, wherein the method includes inresponse to the performing recognition processing opening acommunication channel between a customer administrator user and asupport administrator user, and wherein the performing the one or moreaction includes sending text based action selection data to the customeradministrator user and the support administrator user.
 16. The computerprogram product of claim 13, wherein the method includes in response toa failure of performing recognition to determine the error classifier,sending a communication to a support administrator user prompting actionby the support administrator user to register a new error classifier,wherein the performing recognition processing includes determining thata current error screen matches a prior registered error screen, whereinthe determining includes using Natural Language Processing (NLP)parameters obtained by subjecting the current error screen to NLPprocessing, and using Natural Language Processing (NLP) parametersobtained by subjecting the prior registered error screen to NLPprocessing, and wherein the obtaining iteratively captured frames ofimage data representing a user interface screen includes obtaining theiteratively captured frames in response to an error report activation byan administrator user using an administrator user interface defining theuser interface screen, wherein the administrator user interface isdisplayed on an administrator client computer device that continuouslybuffers screen shots of the user interface screen, wherein the obtainingiteratively captured frames of image data representing a user interfacescreen includes obtaining screen shots of the buffered screen shotshaving capture times prior to a time of the error report activation bythe administrator user.
 17. A system comprising: a memory; at least oneprocessor in communication with the memory; and program instructionsexecutable by one or more processor via the memory to perform a methodcomprising: obtaining iteratively captured frames of image datarepresenting a user interface screen, wherein one or more of the framesof image data represents an error screen indicating an error conditionof one or more resource of a plurality of resources of a servicessystem; performing recognition processing using image data of thecaptured frames of image data to determine an error classifierassociated to the error screen indicating an error condition of one ormore resource of a plurality of resources of a services system, whereinthe performing recognition processing includes using historical data ofa data repository, the historical data including data of past errors ofthe services system; determining one or more action based on the errorclassifier, wherein the determining includes using a decision datastructure that cognitively maps, for first through Nth errorclassifiers, an error classifier to at least one action associated tothe error classifier; and performing the one or more action in responseto the determining, wherein the one or more action is an action forcorrection of the error condition indicated by the error screenindicating an error condition of one or more resource of a plurality ofresources of a services system, wherein the performing recognitionprocessing includes determining that a current error screen matches aprior registered error screen, and wherein the determining includesusing an image hash of the current error screen and an image hash of aprior registered error screen.
 18. The system of claim 17, wherein theperforming recognition processing includes determining that context dataof an error associated to a current error screen matches priorregistered context data of a prior registered error screen, wherein thecontext data of the error associated to the current error screenindicates a certain sequence of activity events by an administratoruser, and wherein the prior registered context data of the priorregistered error screen commonly indicates the same certain sequence ofactivity events by an administrator user.
 19. The system of claim 17,wherein the one or more action includes automatically installing asoftware patch to a software program associated to the error conditionof one or more resource of a plurality of resources of the servicessystem, wherein the automatically installing includes automaticallysending the software patch to a proper address location using datareturned by an IT management system of the services system that tracks acurrent location of the software program, wherein the method includes inresponse to the performing recognition processing opening acommunication channel between a customer administrator user and asupport administrator user, and wherein the performing the one or moreaction includes sending text based action selection data to the customeradministrator user and the support administrator user.
 20. The system ofclaim 17, wherein the method includes in response to a failure ofperforming recognition to determine the error classifier, sending acommunication to a support administrator user prompting action by thesupport administrator user to register a new error classifier, whereinthe performing recognition processing includes determining that acurrent error screen matches a prior registered error screen, whereinthe determining includes using Natural Language Processing (NLP)parameters obtained by subjecting the current error screen to NLPprocessing, and using Natural Language Processing (NLP) parametersobtained by subjecting the prior registered error screen to NLPprocessing, and wherein the obtaining iteratively captured frames ofimage data representing a user interface screen includes obtaining theiteratively captured frames in response to an error report activation byan administrator user using an administrator user interface defining theuser interface screen, wherein the administrator user interface isdisplayed on an administrator client computer device that continuouslybuffers screen shots of the user interface screen, wherein the obtainingiteratively captured frames of image data representing a user interfacescreen includes obtaining screen shots of the buffered screen shotshaving capture times prior to a time of the error report activation bythe administrator user.